Medium severity · published Sep 10, 2020
CVE-2020-15024
An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be stored in Windows main memory after a logout, and after a Lock Vault operation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Antivirus · Avast
20.1.5069.562 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15024
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15024
Third Party Advisory
http://nestedif.com/avast-antivirus-password-manager-vulnerability-improper-session-handling-leading-to-information-disclosure-advisory/
More from Antivirus
9.8
CVE-2025-3500
Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
9.8
CVE-2020-10867
An issue was discovered in Avast Antivirus before 20
9.8
CVE-2017-8307
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete…
8.8
CVE-2021-45337
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by…
8.8
CVE-2021-45336
Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC…